Skip to content

Commit ebf6e4e

Browse files
efd6efd6
authored
santa: add process.entity_id constructed from agent.id, pid and pidversion (#3373)
1 parent d9705c1 commit ebf6e4e

File tree

7 files changed

+153
-84
lines changed

7 files changed

+153
-84
lines changed

‎packages/santa/changelog.yml‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,13 @@
11
# newer versions go on top
2+
- version: "3.1.0"
3+
changes:
4+
- description: Add `process.entity_id` field.
5+
type: enhancement
6+
link: https://github.com/elastic/integrations/pull/3373
27
- version: "3.0.0"
38
changes:
49
- description: Update log format to support the GA releases of Santa. The pre-GA Santa log format (circa 2017) is no longer accepted.
5-
type: breaking-change
10+
type: enhancement
611
link: https://github.com/elastic/integrations/pull/3347
712
- version: "2.1.0"
813
changes:

‎packages/santa/data_stream/log/_dev/test/pipeline/test-santa-raw.log-expected.json‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,7 @@
3737
"xpcproxy",
3838
"com.apple.CoreAuthentication.agent"
3939
],
40+
"entity_id": "71993-1097732",
4041
"executable": "/usr/libexec/xpcproxy",
4142
"hash": {
4243
"sha256": "43158bf397bf52001067319c591249307e2862daf8690828c15cdcc1ddf6166d"
@@ -112,6 +113,7 @@
112113
"/System/Library/PrivateFrameworks/TrustEvaluationAgent.framework/Versions/A/Resources/trustevaluationagent",
113114
"trustevaluationagent"
114115
],
116+
"entity_id": "72012-1097765",
115117
"executable": "/System/Library/PrivateFrameworks/TrustEvaluationAgent.framework/Versions/A/Resources/trustevaluationagent",
116118
"hash": {
117119
"sha256": "7207307ca09d2707368ec394e67c6ccff6e48a2d1d86225a3115fe3535a8237c"
@@ -174,6 +176,7 @@
174176
"args": [
175177
"/usr/libexec/syspolicyd"
176178
],
179+
"entity_id": "377-833",
177180
"executable": "/usr/libexec/syspolicyd",
178181
"name": "syspolicyd",
179182
"parent": {
@@ -224,6 +227,7 @@
224227
"args": [
225228
"/usr/sbin/newsyslog"
226229
],
230+
"entity_id": "71559-1096716",
227231
"executable": "/usr/sbin/newsyslog",
228232
"name": "newsyslog",
229233
"parent": {
@@ -274,6 +278,7 @@
274278
"args": [
275279
"/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/Metadata.framework/Versions/A/Support/mds_stores"
276280
],
281+
"entity_id": "546-1285",
277282
"executable": "/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/Metadata.framework/Versions/A/Support/mds_stores",
278283
"name": "mds_stores",
279284
"parent": {
@@ -323,6 +328,7 @@
323328
"args": [
324329
"/sbin/launchd"
325330
],
331+
"entity_id": "1-521",
326332
"executable": "/sbin/launchd",
327333
"name": "launchd",
328334
"parent": {

‎packages/santa/data_stream/log/elasticsearch/ingest_pipeline/default.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,14 @@ processors:
1616
- '\[%{TIMESTAMP_ISO8601:timestamp}\] %{NOT_SEPARATOR:log.level} santad: action=%{NOT_SEPARATOR:santa.action}\|mount=%{NOT_SEPARATOR:santa.disk.mount}?\|volume=%{NOT_SEPARATOR:santa.disk.volume}\|bsdname=%{NOT_SEPARATOR:santa.disk.bsdname}?(\|fs=%{NOT_SEPARATOR:santa.disk.fs})?(\|model=%{NOT_SEPARATOR:santa.disk.model}?)?(\|serial=%{NOT_SEPARATOR:santa.disk.serial}?)?(\|bus=%{NOT_SEPARATOR:santa.disk.bus}?)?(\|dmgpath=%{NOT_SEPARATOR:santa.disk.dmgpath}?)?(\|appearance=%{TIMESTAMP_ISO8601:santa.disk.appearance})?'
1717
pattern_definitions:
1818
NOT_SEPARATOR: '[^\|]+'
19+
- set:
20+
field: process.entity_id
21+
value: "{{{process.pid}}}-{{{santa.pidversion}}}"
22+
if: "ctx.process?.pid != null && ctx.santa?.pidversion != null"
23+
- set:
24+
field: process.entity_id
25+
value: "{{{agent.id}}}-{{{process.entity_id}}}"
26+
if: "ctx.agent?.id != null && ctx.process?.entity_id != null"
1927
- date:
2028
field: process.start
2129
target_field: process.start

‎packages/santa/data_stream/log/fields/ecs.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,8 @@
22
name: ecs.version
33
- external: ecs
44
name: event.ingested
5+
- external: ecs
6+
name: agent.id
57
- external: ecs
68
name: file.path
79
- external: ecs
@@ -24,6 +26,8 @@
2426
name: process.hash.sha256
2527
- external: ecs
2628
name: process.pid
29+
- external: ecs
30+
name: process.entity_id
2731
- external: ecs
2832
name: process.parent.pid
2933
- external: ecs

‎packages/santa/data_stream/log/sample_event.json‎

Lines changed: 63 additions & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -1,73 +1,95 @@
11
{
2-
"@timestamp": "2022-05-12T11:38:03.923Z",
2+
"@timestamp": "2022-05-12T11:30:05.248Z",
3+
"agent": {
4+
"ephemeral_id": "ea9b3ab9-896a-456a-8e87-7a6452edad19",
5+
"id": "2c596a05-d358-406e-924c-bf221088f43c",
6+
"name": "docker-fleet-agent",
7+
"type": "filebeat",
8+
"version": "8.2.1"
9+
},
10+
"data_stream": {
11+
"dataset": "santa.log",
12+
"namespace": "ep",
13+
"type": "logs"
14+
},
315
"ecs": {
416
"version": "8.2.0"
517
},
18+
"elastic_agent": {
19+
"id": "2c596a05-d358-406e-924c-bf221088f43c",
20+
"snapshot": true,
21+
"version": "8.2.1"
22+
},
623
"event": {
7-
"action": "exec",
8-
"category": [
9-
"process"
10-
],
11-
"kind": "event",
12-
"original": "[2022-05-12T11:38:03.923Z] I santad: action=EXEC|decision=ALLOW|reason=BINARY|explain=critical system binary|sha256=43158bf397bf52001067319c591249307e2862daf8690828c15cdcc1ddf6166d|cert_sha256=d84db96af8c2e60ac4c851a21ec460f6f84e0235beb17d24a78712b9b021ed57|cert_cn=Software Signing|pid=71993|pidversion=1097732|ppid=1|uid=0|user=root|gid=0|group=wheel|mode=M|path=/usr/libexec/xpcproxy|args=xpcproxy com.apple.CoreAuthentication.agent",
13-
"outcome": "success",
14-
"type": [
15-
"start"
16-
]
24+
"action": "link",
25+
"agent_id_status": "verified",
26+
"dataset": "santa.log",
27+
"ingested": "2022-05-18T03:34:40Z",
28+
"kind": "event"
1729
},
1830
"file": {
19-
"x509": {
20-
"issuer": {
21-
"common_name": "Software Signing"
22-
}
23-
}
31+
"path": "/private/var/db/santa/santa.log",
32+
"target_path": "/private/var/db/santa/santa.log.0"
2433
},
2534
"group": {
2635
"id": "0",
2736
"name": "wheel"
2837
},
38+
"host": {
39+
"architecture": "x86_64",
40+
"containerized": false,
41+
"hostname": "docker-fleet-agent",
42+
"ip": [
43+
"192.168.160.7"
44+
],
45+
"mac": [
46+
"02:42:c0:a8:a0:07"
47+
],
48+
"name": "docker-fleet-agent",
49+
"os": {
50+
"codename": "focal",
51+
"family": "debian",
52+
"kernel": "5.10.104-linuxkit",
53+
"name": "Ubuntu",
54+
"platform": "ubuntu",
55+
"type": "linux",
56+
"version": "20.04.4 LTS (Focal Fossa)"
57+
}
58+
},
59+
"input": {
60+
"type": "log"
61+
},
2962
"log": {
30-
"level": "I"
63+
"file": {
64+
"path": "/tmp/service_logs/santa.log"
65+
},
66+
"level": "I",
67+
"offset": 1150
3168
},
3269
"process": {
3370
"args": [
34-
"/usr/libexec/xpcproxy",
35-
"xpcproxy",
36-
"com.apple.CoreAuthentication.agent"
71+
"/usr/sbin/newsyslog"
3772
],
38-
"executable": "/usr/libexec/xpcproxy",
39-
"hash": {
40-
"sha256": "43158bf397bf52001067319c591249307e2862daf8690828c15cdcc1ddf6166d"
41-
},
73+
"entity_id": "2c596a05-d358-406e-924c-bf221088f43c-71559-1096716",
74+
"executable": "/usr/sbin/newsyslog",
75+
"name": "newsyslog",
4276
"parent": {
4377
"pid": 1
4478
},
45-
"pid": 71993,
46-
"start": "2022-05-12T11:38:03.923Z"
79+
"pid": 71559,
80+
"start": "2022-05-12T11:30:05.248Z"
4781
},
4882
"related": {
49-
"hash": [
50-
"d84db96af8c2e60ac4c851a21ec460f6f84e0235beb17d24a78712b9b021ed57",
51-
"43158bf397bf52001067319c591249307e2862daf8690828c15cdcc1ddf6166d"
52-
],
5383
"user": [
5484
"root"
5585
]
5686
},
5787
"santa": {
58-
"action": "EXEC",
59-
"certificate": {
60-
"common_name": "Software Signing",
61-
"sha256": "d84db96af8c2e60ac4c851a21ec460f6f84e0235beb17d24a78712b9b021ed57"
62-
},
63-
"decision": "ALLOW",
64-
"explain": "critical system binary",
65-
"mode": "M",
66-
"pidversion": 1097732,
67-
"reason": "BINARY"
88+
"action": "LINK",
89+
"pidversion": 1096716
6890
},
6991
"tags": [
70-
"preserve_original_event"
92+
"santa-log"
7193
],
7294
"user": {
7395
"id": "0",

‎packages/santa/docs/README.md‎

Lines changed: 65 additions & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -21,75 +21,97 @@ An example event for `log` looks as following:
2121

2222
```json
2323
{
24-
"@timestamp": "2022-05-12T11:38:03.923Z",
24+
"@timestamp": "2022-05-12T11:30:05.248Z",
25+
"agent": {
26+
"ephemeral_id": "ea9b3ab9-896a-456a-8e87-7a6452edad19",
27+
"id": "2c596a05-d358-406e-924c-bf221088f43c",
28+
"name": "docker-fleet-agent",
29+
"type": "filebeat",
30+
"version": "8.2.1"
31+
},
32+
"data_stream": {
33+
"dataset": "santa.log",
34+
"namespace": "ep",
35+
"type": "logs"
36+
},
2537
"ecs": {
2638
"version": "8.2.0"
2739
},
40+
"elastic_agent": {
41+
"id": "2c596a05-d358-406e-924c-bf221088f43c",
42+
"snapshot": true,
43+
"version": "8.2.1"
44+
},
2845
"event": {
29-
"action": "exec",
30-
"category": [
31-
"process"
32-
],
33-
"kind": "event",
34-
"original": "[2022-05-12T11:38:03.923Z] I santad: action=EXEC|decision=ALLOW|reason=BINARY|explain=critical system binary|sha256=43158bf397bf52001067319c591249307e2862daf8690828c15cdcc1ddf6166d|cert_sha256=d84db96af8c2e60ac4c851a21ec460f6f84e0235beb17d24a78712b9b021ed57|cert_cn=Software Signing|pid=71993|pidversion=1097732|ppid=1|uid=0|user=root|gid=0|group=wheel|mode=M|path=/usr/libexec/xpcproxy|args=xpcproxy com.apple.CoreAuthentication.agent",
35-
"outcome": "success",
36-
"type": [
37-
"start"
38-
]
46+
"action": "link",
47+
"agent_id_status": "verified",
48+
"dataset": "santa.log",
49+
"ingested": "2022-05-18T03:34:40Z",
50+
"kind": "event"
3951
},
4052
"file": {
41-
"x509": {
42-
"issuer": {
43-
"common_name": "Software Signing"
44-
}
45-
}
53+
"path": "/private/var/db/santa/santa.log",
54+
"target_path": "/private/var/db/santa/santa.log.0"
4655
},
4756
"group": {
4857
"id": "0",
4958
"name": "wheel"
5059
},
60+
"host": {
61+
"architecture": "x86_64",
62+
"containerized": false,
63+
"hostname": "docker-fleet-agent",
64+
"ip": [
65+
"192.168.160.7"
66+
],
67+
"mac": [
68+
"02:42:c0:a8:a0:07"
69+
],
70+
"name": "docker-fleet-agent",
71+
"os": {
72+
"codename": "focal",
73+
"family": "debian",
74+
"kernel": "5.10.104-linuxkit",
75+
"name": "Ubuntu",
76+
"platform": "ubuntu",
77+
"type": "linux",
78+
"version": "20.04.4 LTS (Focal Fossa)"
79+
}
80+
},
81+
"input": {
82+
"type": "log"
83+
},
5184
"log": {
52-
"level": "I"
85+
"file": {
86+
"path": "/tmp/service_logs/santa.log"
87+
},
88+
"level": "I",
89+
"offset": 1150
5390
},
5491
"process": {
5592
"args": [
56-
"/usr/libexec/xpcproxy",
57-
"xpcproxy",
58-
"com.apple.CoreAuthentication.agent"
93+
"/usr/sbin/newsyslog"
5994
],
60-
"executable": "/usr/libexec/xpcproxy",
61-
"hash": {
62-
"sha256": "43158bf397bf52001067319c591249307e2862daf8690828c15cdcc1ddf6166d"
63-
},
95+
"entity_id": "2c596a05-d358-406e-924c-bf221088f43c-71559-1096716",
96+
"executable": "/usr/sbin/newsyslog",
97+
"name": "newsyslog",
6498
"parent": {
6599
"pid": 1
66100
},
67-
"pid": 71993,
68-
"start": "2022-05-12T11:38:03.923Z"
101+
"pid": 71559,
102+
"start": "2022-05-12T11:30:05.248Z"
69103
},
70104
"related": {
71-
"hash": [
72-
"d84db96af8c2e60ac4c851a21ec460f6f84e0235beb17d24a78712b9b021ed57",
73-
"43158bf397bf52001067319c591249307e2862daf8690828c15cdcc1ddf6166d"
74-
],
75105
"user": [
76106
"root"
77107
]
78108
},
79109
"santa": {
80-
"action": "EXEC",
81-
"certificate": {
82-
"common_name": "Software Signing",
83-
"sha256": "d84db96af8c2e60ac4c851a21ec460f6f84e0235beb17d24a78712b9b021ed57"
84-
},
85-
"decision": "ALLOW",
86-
"explain": "critical system binary",
87-
"mode": "M",
88-
"pidversion": 1097732,
89-
"reason": "BINARY"
110+
"action": "LINK",
111+
"pidversion": 1096716
90112
},
91113
"tags": [
92-
"preserve_original_event"
114+
"santa-log"
93115
],
94116
"user": {
95117
"id": "0",
@@ -103,6 +125,7 @@ An example event for `log` looks as following:
103125
| Field | Description | Type |
104126
|---|---|---|
105127
| @timestamp | Event timestamp. | date |
128+
| agent.id | Unique identifier of this agent (if one exists). Example: For Beats this would be beat.id. | keyword |
106129
| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword |
107130
| cloud.availability_zone | Availability zone in which this host is running. | keyword |
108131
| cloud.image.id | Image ID for the cloud instance. | keyword |
@@ -152,6 +175,7 @@ An example event for `log` looks as following:
152175
| log.level | Original log level of the log event. If the source of the event provides a log level or textual severity, this is the one that goes in `log.level`. If your source doesn't specify one, you may put your event transport's severity here (e.g. Syslog severity). Some examples are `warn`, `err`, `i`, `informational`. | keyword |
153176
| log.offset | Log offset | long |
154177
| process.args | Array of process arguments, starting with the absolute path to the executable. May be filtered to protect sensitive information. | keyword |
178+
| process.entity_id | Unique identifier for the process. The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process. Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | keyword |
155179
| process.executable | Absolute path to the process executable. | keyword |
156180
| process.executable.text | Multi-field of `process.executable`. | match_only_text |
157181
| process.hash.sha256 | SHA256 hash. | keyword |

‎packages/santa/manifest.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
name: santa
22
title: Google Santa Logs
3-
version: 3.0.0
3+
version: 3.1.0
44
release: ga
55
description: Collect and parse logs from Google Santa instances with Elastic Agent.
66
type: integration

0 commit comments

Comments
 (0)